EXECUTIVE SUMMARY Operational Technology (OT) is integral to our everyday lives. The traffic lights controlling the flow of traffic, the signalling systems that regulates train deployment, and the electricity grid that powers up our appliances, are all managed by OT systems. However, such systems are often not designed with adequate cybersecurity in mind, and with the changes in the OT cyber threat landscape, new measures must be taken to secure our OT systems against cyber-attacks. This OT Cybersecurity Masterplan, developed by the Cyber Security Agency of Singapore, aims to enhance the security and resilience of Singapore’s essential service sectors, improve cross-sector response to mitigate cyber threats in the OT environment, and strengthen partnerships with industry and stakeholders. The Masterplan applies to both Critical Information Infrastructure (CII) owners that operate OT systems, as well as other enterprises that face the same OT threats and similar vulnerabilities. These include manufacturing plants in the oil and gas sector, semiconductor factories, and pharmaceutical companies, among others. In addition, the Masterplan will be useful for members of the OT cybersecurity industry, including equipment manufacturers, system integrators and penetration testers. It will help them better understand OT cybersecurity challenges, so that they can develop products and technologies that can be used by operators to strengthen the security of their OT systems. 2 OPERATIONAL TECHNOLOGY CYBERSECURITY MASTERPLAN 2019 To attain higher cybersecurity standards in the OT environment, the Masterplan focuses on enhancing the three main factors of People, Process, and Technology, through the following four key thrusts: • Enhance OT cybersecurity training to raise CII sectors’ preparedness through intermediate to advanced training courses offered by the CSA Academy and its training partners. • Set up an OT Cybersecurity Information Sharing and Analysis Centre to facilitate threat information sharing among OT stakeholders in both the public and private sectors, allowing them to tap on the experiences and expertise from thousands of global organisations and share actionable cyber intelligence. • Strengthen OT cybersecurity policies and processes, including prescribing measures in the OT Cybersecurity Code of Practice that provide cybersecurity controls and outcomes specific to OT systems. • Adopt innovative technologies for system resilience, via the National Cybersecurity Research and Development Programme, industry calls for innovation and putting in place sectoral Security Operations Centres. CSA will continue to work with our OT cybersecurity stakeholders, guided by the OT Cybersecurity Masterplan, to achieve a more resilient and secure OT environment to better serve Singapore. OPERATIONAL TECHNOLOGY CYBERSECURITY MASTERPLAN 2019 3